CVE-2026-107770: Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary media attachments via wpdeleteattachment and upload new attachments to the site, actions that require the uploadfiles or editothersposts capabilities. A Subscriber-level user can obtain their own wplrauthtoken directly from the profile.php page source, because the admin screen guard in MeowWPLRSyncAdmin::construct() is commented out, causing wplocalizescript to leak the token into every admin page view; this token can then be used from a cookie-less HTTP session to invoke destructive actions on the /?wplr-sync-api endpoint.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated attackers can invoke the affected endpoint to delete arbitrary media attachments or upload new attachments. The described token exposure also allows a Subscriber-level user to obtain their own wplr_auth_token from the profile.php page source and use it from a cookie-less HTTP session.
What capabilities can an attacker gain through the affected actions?
An attacker can permanently delete arbitrary media attachments through wp_delete_attachment and upload new attachments to the site. These actions normally require the upload_files or edit_others_posts capabilities.
Which endpoint and actions are involved?
The affected endpoint is /?wplr-sync-api. The described destructive and upload operations use the delete and sync actions.
How can administrators assess whether their installation is in scope?
Installations running Photo Engine versions up to and including 6.5.6 are described as affected. The token exposure can be checked by determining whether a Subscriber can view their wplr_auth_token in the source of profile.php.